CVE-2023-34941

Deeper analysis

A stored cross-site scripting vulnerability exists in the urlFilterList function of the Asus RT-N10LX Router version 2.0.0.39. The flaw, tracked as CWE-79, arises from inadequate sanitization of the URL Keyword List text field and permits injection of arbitrary scripts or HTML. The CVE applies only to this unsupported firmware release and carries a CVSS 3.1 score of 5.4.

An attacker with low privileges can supply a crafted payload to the affected field; when the stored value is later rendered, the script executes in the browser of any user who views the page, resulting in limited confidentiality and integrity impacts. The product is explicitly noted as unsupported by its maintainer, and the two reference URLs point to the same public proof-of-concept repository without additional mitigation guidance. The associated EPSS score has remained flat at 0.0569 with no material rise after disclosure.